@blamejs/pki 0.4.12 → 0.4.14

package/lib/hpke.js

@@ -94,13 +94,29 @@ function _expand(hash, Nh, prk, info, len) {
   if (len > 255 * Nh) throw _err("hpke/export-length", "requested length " + len + " exceeds 255*Nh");
   var out = [], t = Buffer.alloc(0), n = Math.ceil(len / Nh);
   for (var i = 1; i <= n; i++) {
-    t = nodeCrypto.createHmac(hash, prk).update(concat([t, info, Buffer.from([i])])).digest();
+    // The feedback input carries the PREVIOUS output block, so each round's concatenation holds
+    // secret material and is cleared once the HMAC has absorbed it.
+    var fed = concat([t, info, Buffer.from([i])]);
+    t = nodeCrypto.createHmac(hash, prk).update(fed).digest();
+    guard.secret.zeroize(fed, HpkeError, "hpke/bad-input", "an expand feedback input");
     out.push(t);
   }
-  return concat(out).subarray(0, len);
+  // An exact-sized owning buffer, not a VIEW over the joined blocks: this is keying material, and a
+  // caller clearing what it received must not leave the unused tail of the final HMAC block behind
+  // it. The accumulator and each block are cleared here.
+  var joined = concat(out);
+  var exact = Buffer.alloc(len);
+  joined.copy(exact, 0, 0, len);
+  guard.secret.zeroize(joined, HpkeError, "hpke/bad-input", "the KDF accumulator");
+  for (var oi = 0; oi < out.length; oi++) guard.secret.zeroize(out[oi], HpkeError, "hpke/bad-input", "a KDF block");
+  return exact;
 }
 function _labeledExtract(kdf, suiteId, salt, label, ikm) {
-  return _extract(kdf.hash, kdf.Nh, salt, concat([HPKE_V1, suiteId, L(label), ikm]));
+  // The concatenation copies the input keying material -- a DH secret or a PSK -- into a fresh
+  // buffer, so that copy is cleared once extract has consumed it. The caller still owns .
+  var labeled = concat([HPKE_V1, suiteId, L(label), ikm]);
+  try { return _extract(kdf.hash, kdf.Nh, salt, labeled); }
+  finally { guard.secret.zeroize(labeled, HpkeError, "hpke/bad-input", "the labeled extract input"); }
 }
 function _labeledExpand(kdf, suiteId, prk, label, info, len) {
   return _expand(kdf.hash, kdf.Nh, prk, concat([i2osp(len, 2), HPKE_V1, suiteId, L(label), info]), len);
@@ -177,8 +193,11 @@ function _generate(kem) {
 function _kemSuiteId(kemId) { return concat([L("KEM"), i2osp(kemId, 2)]); }
 function _extractAndExpand(kem, dh, kemContext) {
   var kdf = _kdf(kem.kdf), sid = _kemSuiteId(_kemId(kem));
+  // The extract PRK is a secret intermediate this function allocated: it is as sensitive as the DH
+  // input it summarises, so it is cleared once the expand has consumed it.
   var eaePrk = _labeledExtract(kdf, sid, Buffer.alloc(0), "eae_prk", dh);
-  return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret);
+  try { return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret); }
+  finally { guard.secret.zeroize(eaePrk, HpkeError, "hpke/bad-input", "the KEM extract PRK"); }
 }
 function _kemId(kem) { for (var k in KEMS) if (KEMS[k] === kem) return Number(k); return 0; }
 
@@ -189,25 +208,49 @@ function _ephemeral(kem, eph) {
   var kp = _generate(kem);
   return { skE: kp.privateKey, enc: _exportPublic(kem, kp.publicKey) };
 }
+// The raw DH output is the KEM's shared secret before extraction: it is this module's allocation
+// and is cleared once _extractAndExpand has consumed it, on every DHKEM arm. In the authenticated
+// arms  builds a THIRD copy holding both DH results, so the concatenation is cleared as
+// well -- clearing only the pieces would leave the joined buffer readable.
+function _wipeDh(dh) { guard.secret.zeroize(dh, HpkeError, "hpke/bad-input", "the KEM shared secret"); }
+// EVERY agreement happens inside the protected region. In the authenticated modes the second
+// agreement can throw on an attacker-supplied low-order sender key, and a first secret computed
+// outside the region would be left behind on exactly that failure path.
 function _encap(kem, pkR, pkRm, eph) {
   var e = _ephemeral(kem, eph);
-  var dh = _dh(e.skE, pkR);
-  return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm])), enc: e.enc };
+  var dh = null;
+  try {
+    dh = _dh(e.skE, pkR);
+    return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm])), enc: e.enc };
+  } finally { _wipeDh(dh); }
 }
 function _decap(kem, enc, skR, pkRm) {
   var pkE = _importPublic(kem, enc);
-  var dh = _dh(skR, pkE);
-  return _extractAndExpand(kem, dh, concat([enc, pkRm]));
+  var dh = null;
+  try {
+    dh = _dh(skR, pkE);
+    return _extractAndExpand(kem, dh, concat([enc, pkRm]));
+  } finally { _wipeDh(dh); }
 }
 function _authEncap(kem, pkR, pkRm, skS, pkSm, eph) {
   var e = _ephemeral(kem, eph);
-  var dh = concat([_dh(e.skE, pkR), _dh(skS, pkR)]);
-  return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm, pkSm])), enc: e.enc };
+  var dh1 = null, dh2 = null, dh = null;
+  try {
+    dh1 = _dh(e.skE, pkR);
+    dh2 = _dh(skS, pkR);
+    dh = concat([dh1, dh2]);
+    return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm, pkSm])), enc: e.enc };
+  } finally { _wipeDh(dh1); _wipeDh(dh2); _wipeDh(dh); }
 }
 function _authDecap(kem, enc, skR, pkRm, pkS, pkSm) {
   var pkE = _importPublic(kem, enc);
-  var dh = concat([_dh(skR, pkE), _dh(skR, pkS)]);
-  return _extractAndExpand(kem, dh, concat([enc, pkRm, pkSm]));
+  var dh1 = null, dh2 = null, dh = null;
+  try {
+    dh1 = _dh(skR, pkE);
+    dh2 = _dh(skR, pkS);
+    dh = concat([dh1, dh2]);
+    return _extractAndExpand(kem, dh, concat([enc, pkRm, pkSm]));
+  } finally { _wipeDh(dh1); _wipeDh(dh2); _wipeDh(dh); }
 }
 
 // ---- key schedule (RFC 9180 sec. 5.1) ----------------------------------------
@@ -227,14 +270,20 @@ function _keySchedule(suite, mode, sharedSecret, info, psk, pskId, role) {
   var pskIdHash = _labeledExtract(kdf, sid, Buffer.alloc(0), "psk_id_hash", pskId);
   var infoHash = _labeledExtract(kdf, sid, Buffer.alloc(0), "info_hash", info);
   var ksc = concat([Buffer.from([mode]), pskIdHash, infoHash]);
+  //  is the key schedule's master PRK -- every key below is derived from it, so it is the
+  // most valuable intermediate here and is cleared once the derivations are done.
   var secret = _labeledExtract(kdf, sid, sharedSecret, "secret", psk);
-  var exporterSecret = _labeledExpand(kdf, sid, secret, "exp", ksc, kdf.Nh);
-  var key = null, baseNonce = null;
-  if (!aead.exportOnly) {
-    key = _labeledExpand(kdf, sid, secret, "key", ksc, aead.Nk);
-    baseNonce = _labeledExpand(kdf, sid, secret, "base_nonce", ksc, aead.Nn);
+  try {
+    var exporterSecret = _labeledExpand(kdf, sid, secret, "exp", ksc, kdf.Nh);
+    var key = null, baseNonce = null;
+    if (!aead.exportOnly) {
+      key = _labeledExpand(kdf, sid, secret, "key", ksc, aead.Nk);
+      baseNonce = _labeledExpand(kdf, sid, secret, "base_nonce", ksc, aead.Nn);
+    }
+    return new Context(suite, key, baseNonce, exporterSecret, role);
+  } finally {
+    guard.secret.zeroize(secret, HpkeError, "hpke/bad-input", "the key-schedule PRK");
   }
-  return new Context(suite, key, baseNonce, exporterSecret, role);
 }
 
 // ---- AEAD context (RFC 9180 sec. 5.2 / 5.3) ----------------------------------
@@ -246,6 +295,12 @@ function Context(suite, key, baseNonce, exporterSecret, role) {
   this._suite = suite; this._key = key; this._baseNonce = baseNonce;
   this._exporterSecret = exporterSecret; this._seq = 0n; this._role = role;
 }
+// Clear the context's key material. The single-shot entry points below build a context, use it once
+// and drop it, so without this the AEAD key, base nonce and exporter secret stay readable for the
+// process lifetime -- the multi-message API hands the context to the caller, who owns its lifetime.
+Context.prototype._dispose = function () {
+  guard.secret.zeroizeAll([this._key, this._baseNonce, this._exporterSecret], HpkeError, "hpke/bad-input", "the HPKE context key material");
+};
 Context.prototype._nonce = function () {
   var aead = this._suite.aead;
   var seqBytes = i2osp(this._seq, aead.Nn);
@@ -431,7 +486,10 @@ function _setupR(ids, enc, skR, opts) {
   } else {
     ss = _decap(kem, _buf(enc), r.key, r.pkm);
   }
-  return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R");
+  // The recipient derives this shared secret and never hands it back (unlike setupS, whose caller
+  // receives it and owns it from then on), so it is cleared once the key schedule has consumed it.
+  try { return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R"); }
+  finally { guard.secret.zeroize(ss, HpkeError, "hpke/bad-input", "the KEM shared secret"); }
 }
 
 /**
@@ -453,8 +511,21 @@ function _setupR(ids, enc, skR, opts) {
  *   var out = pki.hpke.seal(ids, pkR, {}, Buffer.from("aad"), Buffer.from("msg"));
  */
 function seal(ids, pkR, opts, aad, pt) {
-  var s = _setupS(ids, pkR, opts);
+  // _setupS itself can reject after allocating (an unusable AEAD, a bad psk pairing), so the whole
+  // call is inside the protected region rather than only what follows a successful setup.
+  var s = null;
+  try {
+  s = _setupS(ids, pkR, opts);
+  // The single-shot wrapper returns neither the setup result nor its shared secret, so no caller can
+  // own that buffer -- it is cleared here along with the context. setupS itself still hands both to
+  // its caller, whose lifetime they become.
   return { enc: s.enc, ct: s.context.seal(_buf(aad), _buf(pt)) };
+  } finally {
+    if (s) {
+      s.context._dispose();
+      guard.secret.zeroize(s.sharedSecret, HpkeError, "hpke/bad-input", "the KEM shared secret");
+    }
+  }
 }
 
 /**
@@ -477,7 +548,9 @@ function seal(ids, pkR, opts, aad, pt) {
  *   var pt = pki.hpke.open(ids, o.enc, { skm: skR, pkm: pkR }, {}, Buffer.alloc(0), o.ct);
  */
 function open(ids, enc, skR, opts, aad, ct) {
-  return _setupR(ids, enc, skR, opts).open(_buf(aad), _buf(ct));
+  var ctx = _setupR(ids, enc, skR, opts);
+  try { return ctx.open(_buf(aad), _buf(ct)); }
+  finally { ctx._dispose(); }
 }
 
 module.exports = {

package/lib/key.js

@@ -120,11 +120,23 @@ async function encrypt(privateKey, password, opts) {
   var iterations = pbes2.assertIterations(opts.iterations == null ? 600000 : opts.iterations, _err, "key");
   var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : nodeCrypto.randomBytes(16);
   var iv = nodeCrypto.randomBytes(16);
-  var dk = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(password, _err, "key"), salt, iterations, keyBits / 8, prfNode);
-  var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
-  var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
-  pkcs8.parseEncrypted(epki);   // self-check: the produced EncryptedPrivateKeyInfo re-parses
-  return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
+  // The derived key protects a PRIVATE KEY, so it is cleared as soon as the encryption is done. The
+  // caller's password is untouched -- passwordBytes returns a supplied Buffer as-is.
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  var pwK = pbes2.passwordBytesOwned(password, _err, "key");
+  var dk;
+  try { dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
+  finally { if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding"); }
+  try {
+    var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
+    var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
+    pkcs8.parseEncrypted(epki);   // self-check: the produced EncryptedPrivateKeyInfo re-parses
+    return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
+  } finally {
+    guard.secret.zeroize(dk, KeyError, "key/bad-input", "the password-derived encryption key");
+  }
 }
 
 /**
@@ -176,7 +188,13 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
   // The shared PBES2 decrypt home (strict params + the uniform decrypt-failed on a wrong key / bad pad). The
   // plaintext re-parse below is the MAC-less PBES2-CBC integrity check (RFC 8018 sec. 8): a bad pad and a
   // valid pad whose plaintext is not a PrivateKeyInfo are indistinguishable, and it MUST run (never skipped).
-  var plaintext = pbes2.pbes2Decrypt(pbes2.passwordBytes(password, _err, "key"), encAlg.parameters, ciphertext, opts, _err, "key");
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  var pwD = pbes2.passwordBytesOwned(password, _err, "key");
+  var plaintext;
+  try { plaintext = pbes2.pbes2Decrypt(pwD.bytes, encAlg.parameters, ciphertext, opts, _err, "key"); }
+  finally { if (pwD.owned) guard.secret.zeroize(pwD.bytes, KeyError, "key/bad-input", "the password encoding"); }
   try { pkcs8.parse(plaintext); }
   catch (_e) { throw _err("key/decrypt-failed", "decryption failed"); }
   return plaintext;

package/lib/lint.js

@@ -628,8 +628,10 @@ var CABF_TLS_RULES = [
 
 // RFC 9935 -- ML-KEM public keys in X.509 certificates. The OID is the sole authority for the
 // parameter set; the SPKI BIT STRING is the raw ek, exactly 384k+32 octets for that OID.
+// Encapsulation-key lengths come from the shared ML-KEM parameter registry (FIPS 203 Table 3),
+// keyed by NAME because an SPKI surfaces its algorithm by name on this path.
 var ML_KEM_EK_LEN = {};
-["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n, i) { ML_KEM_EK_LEN[n] = [800, 1184, 1568][i]; });
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_EK_LEN[n] = oid.kemParams(n).ek; });
 function _isMlKem(cert) {
   var spki = cert.subjectPublicKeyInfo;
   return !!(spki && spki.algorithm && ML_KEM_EK_LEN[spki.algorithm.name] !== undefined);

package/lib/oid.js

@@ -693,11 +693,46 @@ function paramsMustBeAbsent(dotted) {
   return _PARAMS_ABSENT.has(dotted);
 }
 
+// ---- ML-KEM parameter sets (FIPS 203 Table 3) --------------------------------
+//
+// ONE row per parameter set, resolvable by dotted OID or by registered name, because the
+// consumers hold different currencies: the CMS codec and the decrypt path key by OID, the
+// linter keys by the SPKI algorithm's name. Before this table the same FIPS 203 constants
+// lived in three modules -- schema-cms's ciphertext lengths, webcrypto's {ek, dk}, and
+// lint's encapsulation-key lengths -- so a fourth consumer (a composite KEM, an HPKE row,
+// HQC by analogy) meant a fourth copy, and the ek values were already duplicated verbatim
+// in two of them. A parameter set is a property OF the algorithm identifier, so it lives
+// beside the registry that resolves one rather than in whichever module needed it first.
+//
+//   ek : encapsulation-key octets      dk : decapsulation-key octets
+//   ct : ciphertext octets             ss : shared-secret octets
+// A null-prototype table: a plain object would answer kemParams("toString") with a function
+// inherited from Object.prototype, so the documented fail-closed contract would hold for every
+// input EXCEPT the handful every object already carries -- exactly the ones an untrusted
+// identifier might be.
+var KEM_PARAMS = Object.create(null);
+[["id-ml-kem-512", 800, 1632, 768, 32],
+  ["id-ml-kem-768", 1184, 2400, 1088, 32],
+  ["id-ml-kem-1024", 1568, 3168, 1568, 32]].forEach(function (r) {
+  // FROZEN, because these rows are reachable from the public surface AND one of them now governs a
+  // security check: the engine reads .ct to enforce the FIPS 203 sec. 7.3 ciphertext length. A shared
+  // mutable row would let any code in the process rewrite that bound once, for every later call --
+  // a parameter set is a fact about the algorithm, not a setting an application may retune.
+  var row = Object.freeze({ ek: r[1], dk: r[2], ct: r[3], ss: r[4] });
+  KEM_PARAMS[byName(r[0])] = row;   // by dotted OID
+  KEM_PARAMS[r[0]] = row;           // and by registered name -- the same frozen row
+});
+Object.freeze(KEM_PARAMS);
+// kemParams(oidOrName) -> the row, or undefined for anything that is not an ML-KEM
+// parameter set. Undefined is the caller's signal to fail closed; it never guesses a size.
+function kemParams(oidOrName) { return KEM_PARAMS[oidOrName]; }
+
 module.exports = {
   name:           name,
   byName:         byName,
   has:            has,
   paramsMustBeAbsent: paramsMustBeAbsent,
+  kemParams:      kemParams,
   register:       register,
   registerFamily: registerFamily,
   all:            all,

package/lib/pbes2.js

@@ -38,10 +38,17 @@ var CONTENT_KEYBITS = {}, CONTENT_MODE = {};
 
 // A password is an octet string (RFC 8018 sec. 2): a string is UTF-8-encoded deterministically (correct for
 // non-ASCII, and byte-identical to OpenSSL), a Buffer/Uint8Array used verbatim.
-function passwordBytes(p, E, prefix) {
-  if (Buffer.isBuffer(p)) return p;
-  if (p instanceof Uint8Array) return Buffer.from(p);
-  if (typeof p === "string") return Buffer.from(p, "utf8");
+function passwordBytes(p, E, prefix) { return passwordBytesOwned(p, E, prefix).bytes; }
+
+// The same conversion, reporting OWNERSHIP. A string or Uint8Array password is encoded into a fresh
+// Buffer this toolkit allocated -- a credential copy that must be cleared once the derivation has
+// consumed it -- while a caller-supplied Buffer is BORROWED and must be left intact. Without this
+// distinction a call site can only be safe by leaving every password encoding readable, which is
+// the common case, since a password arrives as a string far more often than as a Buffer.
+function passwordBytesOwned(p, E, prefix) {
+  if (Buffer.isBuffer(p)) return { bytes: p, owned: false };
+  if (p instanceof Uint8Array) return { bytes: Buffer.from(p), owned: true };
+  if (typeof p === "string") return { bytes: Buffer.from(p, "utf8"), owned: true };
   throw E(prefix + "/bad-input", "a password must be a string, Buffer, or Uint8Array");
 }
 
@@ -148,8 +155,19 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
   var iterations = assertIterations(opts.iterations == null ? 2048 : opts.iterations, E, prefix);
   var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : nodeCrypto.randomBytes(16);
   var iv = opts.iv != null ? opts.iv : nodeCrypto.randomBytes(16);
+  // The derived key is this module's allocation and protects the caller's plaintext -- a private key
+  // in the pkcs8 / pkcs12 callers -- so it is cleared once the encryption has consumed it. pwBytes is
+  // NOT: the caller formatted it and may still own the buffer.
   var key = nodeCrypto.pbkdf2Sync(pwBytes, salt, iterations, keyBits / 8, prfNode);
-  return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits) };
+  try {
+    return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits) };
+  } finally {
+    // E is the caller's error FACTORY, not a class; guard-secret delegates its only throw to
+    // guard-bytes, which constructs.  yields the error the factory returns, so the
+    // currency is compatible -- and the throw is unreachable here regardless, because a freshly
+    // allocated pbkdf2 buffer cannot be detached.
+    guard.secret.zeroize(key, E, prefix + "/bad-input", "the password-derived encryption key");
+  }
 }
 
 // PBES2 AES-CBC DECRYPT: parse the PBES2 params (PBKDF2 kdf + AES-CBC scheme), derive the key from
@@ -182,6 +200,7 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix) {
   var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
   try { return cbcDecrypt(dk, iv, ciphertext, keyBits); }
   catch (_e) { throw E(prefix + "/decrypt-failed", "decryption failed"); }
+  finally { guard.secret.zeroize(dk, E, prefix + "/bad-input", "the password-derived decryption key"); }
 }
 
 // ---- PBMAC1 (RFC 9579 / RFC 8018 App. A.5) : PBKDF2 -> HMAC over a message --
@@ -207,14 +226,24 @@ function pbmac1(pwBytes, salt, iterationCount, keyLength, prfHash, macHash, mess
   return subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]).then(function (baseKey) {
     return subtle.deriveBits({ name: "PBKDF2", salt: salt, iterations: iterationCount, hash: prfHash }, baseKey, keyLength * 8);
   }).then(function (bits) {
-    return subtle.importKey("raw", Buffer.from(bits), { name: "HMAC", hash: macHash }, false, ["sign"]).then(function (hmacKey) {
+    // The derived MAC key is this function's allocation, in two forms: the ArrayBuffer deriveBits
+    // returned and the Buffer view over it that is imported. Clearing the view clears both, and it
+    // runs whether the signing succeeds or throws -- the sibling PBES2 encrypt/decrypt above clear
+    // their derived keys, and every PBMAC1 consumer (PKCS#12 build and verification) inherits this.
+    var mk = Buffer.from(bits);
+    return subtle.importKey("raw", mk, { name: "HMAC", hash: macHash }, false, ["sign"]).then(function (hmacKey) {
       return subtle.sign({ name: "HMAC" }, hmacKey, message);
+    }).finally(function () {
+      // pbmac1 takes no caller error factory, and this key is engine-adjacent, so the engine's
+      // typed class is the right currency -- a raw TypeError must never escape a lib boundary.
+      // Unreachable in practice: a freshly allocated Buffer cannot be detached.
+      guard.secret.zeroize(mk, webcrypto.WebCryptoError, "webcrypto/operation", "the PBMAC1 key");
     });
   }).then(function (sig) { return Buffer.from(sig); });
 }
 
 module.exports = {
-  passwordBytes: passwordBytes, assertIterations: assertIterations, assertSalt: assertSalt,
+  passwordBytes: passwordBytes, passwordBytesOwned: passwordBytesOwned, assertIterations: assertIterations, assertSalt: assertSalt,
   prfNodeByName: prfNodeByName, prfNodeByOid: prfNodeByOid,
   pbkdf2ParamsSeq: pbkdf2ParamsSeq, pbes2AlgId: pbes2AlgId, parsePbkdf2Params: parsePbkdf2Params,
   requireChildren: requireChildren, seqChildren: seqChildren,

package/lib/pkcs12-build.js

@@ -100,7 +100,17 @@ var DIGEST_NAME = { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "s
 // RFC 7292 App. B.1: a PKCS#12 password is the BMPString (UTF-16BE) encoding of the string plus a trailing
 // 2-byte NULL terminator. "Beavis" -> 14 bytes. A non-BMP scalar (surrogate) is rejected. A Buffer/Uint8Array
 // is taken verbatim as already-formatted bytes (an escape hatch for a caller that pre-encodes).
-function _p12Password(pw) {
+function _p12Password(pw) { return _p12PasswordOwned(pw).bytes; }
+
+// The same encoding, reporting OWNERSHIP -- mirroring pbes2.passwordBytesOwned. A caller-supplied
+// Buffer is returned AS-IS and is BORROWED: clearing it would destroy the caller's own credential,
+// which is a worse defect than leaving a copy readable. Every other input is re-encoded into a
+// buffer this module allocated, which it must clear once a derivation has consumed it.
+function _p12PasswordOwned(pw) {
+  if (Buffer.isBuffer(pw)) return { bytes: pw, owned: false };
+  return { bytes: _p12Encode(pw), owned: true };
+}
+function _p12Encode(pw) {
   if (pw == null) pw = "";
   if (Buffer.isBuffer(pw)) return pw;
   if (pw instanceof Uint8Array) return Buffer.from(pw);
@@ -148,16 +158,43 @@ function _blockFill(src, blockSize) {
 function _p12Kdf(hashName, id, pwBytes, salt, iterations, nBytes) {
   var uv = P12_KDF_UV[hashName], u = uv.u, v = uv.v;
   var D = Buffer.alloc(v, id);                                          // step 1: v copies of the ID diversifier
-  var I = Buffer.concat([_blockFill(salt, v), _blockFill(pwBytes, v)]); // steps 2-4: I = S || P
+  // Each fill is a full block-repeated copy of the salt / password; only their concatenation is
+  // used, so the sources are cleared rather than abandoned.
+  var sFill = _blockFill(salt, v), pFill = _blockFill(pwBytes, v);
+  var I = Buffer.concat([sFill, pFill]);                                // steps 2-4: I = S || P
+  guard.secret.zeroizeAll([sFill, pFill], Pkcs12Error, "pkcs12/bad-input", "a key-derivation fill");
   var c = Math.ceil(nBytes / u);                                        // step 5
-  var out = Buffer.alloc(0);
+  // The accumulator is allocated ONCE at its final size. Growing it with Buffer.concat per round
+  // would abandon a password-derived copy of everything derived so far on every iteration, and
+  // those copies could not be reached to clear. Each intermediate digest is cleared as it is
+  // superseded, so only the value actually in use is ever readable.
+  var out = Buffer.alloc(c * u);
   for (var i = 0; i < c; i++) {                                         // step 6
     var A = Buffer.concat([D, I]);
-    for (var r = 0; r < iterations; r++) A = nodeCrypto.createHash(hashName).update(A).digest();   // 6A: A = H^r(D||I)
-    out = Buffer.concat([out, A]);                                      // step 7 (accumulate A_1..A_c)
-    if (i < c - 1) _kdfStepC(I, _blockFill(A, v), v);                   // 6B+6C: modify I for the next block
+    for (var r = 0; r < iterations; r++) {                              // 6A: A = H^r(D||I)
+      var prev = A;
+      A = nodeCrypto.createHash(hashName).update(A).digest();
+      guard.secret.zeroize(prev, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
+    }
+    A.copy(out, i * u);                                                 // step 7 (accumulate A_1..A_c)
+    if (i < c - 1) {                                                    // 6B+6C: modify I for the next block
+      var B = _blockFill(A, v);                                         // a full password-derived block
+      _kdfStepC(I, B, v);
+      guard.secret.zeroize(B, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
+    }
+    guard.secret.zeroize(A, Pkcs12Error, "pkcs12/bad-input", "a key-derivation block");
   }
-  return out.subarray(0, nBytes);                                      // step 8: first nBytes of A
+  // I is S || P -- it carries the password bytes -- and is finished with here.
+  guard.secret.zeroize(I, Pkcs12Error, "pkcs12/bad-input", "the key-derivation input block");
+  // Step 8 is "the first nBytes of A", but returning a SUBARRAY would hand back a view over a
+  // larger allocation: a caller clearing what it received would leave the rest of the final digest
+  // block -- password-derived material -- readable in the same backing buffer (15 unused bytes
+  // behind a 5-byte RC2 key, 16 behind a 24-byte 3DES key). Copy into an exact-sized buffer the
+  // caller wholly owns, and clear the oversized accumulator here, where it was allocated.
+  var exact = Buffer.alloc(nBytes);
+  out.copy(exact, 0, 0, nBytes);
+  guard.secret.zeroize(out, Pkcs12Error, "pkcs12/bad-input", "the key-derivation accumulator");
+  return exact;
 }
 
 // RFC 7292 App. B.2 step 6C: treat I as consecutive v-byte blocks and set each I_j = (I_j + B + 1) mod 2^(8v)
@@ -344,10 +381,18 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var node = DIGEST_NAME[hash];
     if (!node || !P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + JSON.stringify(hash) + " (sha1 / sha256 / sha384 / sha512)");
     var iter = _assertMacIter(macOpts.iterations == null ? DEFAULT_MAC_ITER : macOpts.iterations, CLASSIC_MAC_MAX_ITERATIONS);
-    var macKey = _p12Kdf(node, 3, _p12Password(password), salt, iter, P12_KDF_UV[node].u);   // classic KDF -> BMPString
-    var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
-    var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
-    return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
+    // _p12Password always ALLOCATES (it re-encodes to BMPString + NULL), so its result is this
+    // module's own credential copy and is cleared once the derivation has consumed it.
+    var macPw = _p12PasswordOwned(password);
+    var macKey = _p12Kdf(node, 3, macPw.bytes, salt, iter, P12_KDF_UV[node].u);   // classic KDF -> BMPString
+    if (macPw.owned) guard.secret.zeroize(macPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
+    try {
+      var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
+      var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
+      return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
+    } finally {
+      guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key");
+    }
   }
   if (algorithm === "pbmac1") {
     var prf = PBMAC1_PRF[hash];
@@ -495,8 +540,11 @@ async function verifyMac(pfx, password, opts) {
     if (!P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + m.mac.hashName);
     // The iteration count and salt are attacker-controlled work factors: bound them BEFORE the KDF runs.
     _capWork(m.mac.iterations, m.mac.macSalt, opts, undefined, CLASSIC_MAC_MAX_ITERATIONS);
-    var macKey = _p12Kdf(node, 3, _p12Password(password), m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);   // classic KDF -> BMPString
-    computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest();
+    var vMacPw = _p12PasswordOwned(password);
+    var macKey = _p12Kdf(node, 3, vMacPw.bytes, m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);   // classic KDF -> BMPString
+    if (vMacPw.owned) guard.secret.zeroize(vMacPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
+    try { computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest(); }
+    finally { guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key"); }
   } else {
     var kdf = m.mac.pbmac1.kdf;
     var prfWc = PRF_WC[kdf.prfName];
@@ -693,17 +741,22 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
   var u = P12_KDF_UV[scheme.hash].u;
   budget.rounds -= (Math.ceil(scheme.keyLen / u) + Math.ceil(scheme.ivLen / u)) * iterations;
   if (budget.rounds < 0) throw _err("pkcs12/iteration-limit", "the store's aggregate legacy PBE key-derivation work exceeds the budget (a hostile many-bag store)");
-  var p12pw = _p12Password(password);   // App. B.1 BMPString + NULL (NOT the PBES2 UTF-8 encoding)
-  var keyM = _p12Kdf(scheme.hash, 1, p12pw, salt, iterations, scheme.keyLen);
-  var iv = _p12Kdf(scheme.hash, 2, p12pw, salt, iterations, scheme.ivLen);
+  var p12pw = _p12PasswordOwned(password);   // App. B.1 BMPString + NULL (NOT the PBES2 UTF-8 encoding)
+  var keyM = _p12Kdf(scheme.hash, 1, p12pw.bytes, salt, iterations, scheme.keyLen);
+  var iv = _p12Kdf(scheme.hash, 2, p12pw.bytes, salt, iterations, scheme.ivLen);
+  if (p12pw.owned) guard.secret.zeroize(p12pw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
   // BOTH ciphers funnel through ONE uniform failure (same code AND message), so a bad-pad (secret-dependent)
   // and a valid-pad-wrong-content outcome are indistinguishable -- no CBC padding oracle (RFC 8018 sec. 8). RC2
   // is unavailable in node; the in-tree RFC 2268 primitive fills the gap and its typed reject is normalized here.
+  // keyM is a password-derived key this function allocated -- the PBES2 arm of the same dispatch
+  // clears its equivalent, so this arm owes it too, on the failing path an attacker drives. The
+  // derived IV is not secret and is left alone.
   try {
     if (scheme.rc2) return rc2.cbcDecrypt(keyM, scheme.rc2, iv, ct, _err, "pkcs12/decrypt-failed");
     var d = nodeCrypto.createDecipheriv(scheme.cipher, keyM, iv);
     return Buffer.concat([d.update(ct), d.final()]);
   } catch (_e) { throw _err("pkcs12/decrypt-failed", "decryption failed"); }
+  finally { guard.secret.zeroize(keyM, Pkcs12Error, "pkcs12/bad-input", "the password-derived decryption key"); }
 }
 
 // Decrypt a PBES2 (RFC 8018) or legacy-PBE (RFC 7292 App. C) bag/safe -- dispatch on the encryptionAlgorithm

package/lib/schema-cms.js

@@ -106,10 +106,10 @@ WRAP_KEK_LENGTHS[oid.byName("aes256-wrap")] = 32;
 // ML-KEM OID -> the exact ciphertext (kemct) length in octets (FIPS 203). A
 // recognized ML-KEM kem carries a fixed-size ciphertext; any other length can
 // never decapsulate. (The params-absent rule rides the shared oid registry.)
+// Ciphertext lengths come from the shared ML-KEM parameter registry (FIPS 203 Table 3) rather
+// than a local copy, so this codec and the crypto engine cannot disagree about a parameter set.
 var KEM_CT_LENGTHS = {};
-KEM_CT_LENGTHS[oid.byName("id-ml-kem-512")] = 768;
-KEM_CT_LENGTHS[oid.byName("id-ml-kem-768")] = 1088;
-KEM_CT_LENGTHS[oid.byName("id-ml-kem-1024")] = 1568;
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { KEM_CT_LENGTHS[oid.byName(n)] = oid.kemParams(n).ct; });
 
 // Recognized AEAD content-encryption OIDs -> the AES-GCM/CCM parameter shape + the
 // legal ICVlen set (RFC 5084). An unrecognized content-encryption OID surfaces its